a command line packet analyzer

learn more… | top users | synonyms

10
votes
1answer
6k views

Buffer size for capturing packets in kernel space?

Going through the man page of tcpdump, it seems kernel can drop the packets if the buffer is full. I was wondering if: that size is configurable and/or where can I see the size for my distro? From ...
4
votes
1answer
906 views

How to recover a file from a tcpdump?

I use tcpdump -i wlan0 -s 0 dst 192.168.1.200 or src 192.168.1.200 -w output.pcap to monitor for ex.: my HTTP traffic. I upload a .zip file through HTTP. How can I retrieve the .zip file from the ...
8
votes
3answers
8k views

How to process/pipe TCPDUMPs output in realtime

If I want to tcpdump DNS requests by clients (on an OpenWrt 10.04 router), then I root@ROUTER:/etc# tcpdump -n -i br-lan dst port 53 2>&1 tcpdump: verbose output suppressed, use -v or ...
1
vote
3answers
921 views

using “-vvv” with “-w FILENAME” with tcpdump makes better output?

Does it makes a more detailed output if I use tcpdump -vvv -w FILENAME vs. if I use: tcpdump -w FILENAME or it doesn't makes any sense if I use the "-vvv" when I'm using "-w FILENAME"?